File name:

Click_here.zip

Full analysis: https://app.any.run/tasks/3315c535-1c8e-4cc3-af54-e74935625f13
Verdict: Malicious activity
Analysis date: December 19, 2023, 11:20:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

B4E9DDFA5DA9F2C7B0B1A0CEE0F6159C

SHA1:

971FE6EC764342D31E0F2B10DD09C8763560426D

SHA256:

15A6FC69CAE8D98C9AFA0A60D06B5FEE5940741490D28FB3C33A059008B91106

SSDEEP:

12288:STqLuovP1PKq58xRqb+IbK5HIFBWdErKXu5gILjWi:OqLumP1PKq5o8aIbKlIFuE4AgILD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 2544)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Setup.exe (PID: 2544)
      • Setup.exe (PID: 3012)
      • Setup.exe (PID: 3828)
      • Setup.exe (PID: 3632)
      • Setup.exe (PID: 4060)
      • Setup.exe (PID: 324)
      • Setup.exe (PID: 1576)
      • taskmgr.exe (PID: 3112)
      • sipnotify.exe (PID: 1792)
      • runonce.exe (PID: 2036)
      • taskmgr.exe (PID: 4076)

    • Application launched itself

      • taskmgr.exe (PID: 3112)
      • WerFault.exe (PID: 348)
      • taskmgr.exe (PID: 4076)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1664)
      • sipnotify.exe (PID: 1792)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1792)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 2120)
      • ShedulerYori.exe (PID: 2856)
      • Setup.exe (PID: 3632)
      • ShedulerYori.exe (PID: 4036)
      • Setup.exe (PID: 3828)
      • ShedulerYori.exe (PID: 3872)
      • Setup.exe (PID: 3012)
      • Setup.exe (PID: 2544)
      • ShedulerYori.exe (PID: 3092)
      • Setup.exe (PID: 4060)
      • ShedulerYori.exe (PID: 4028)
      • Setup.exe (PID: 324)
      • ShedulerYori.exe (PID: 1596)
      • Setup.exe (PID: 1576)
      • ShedulerYori.exe (PID: 1972)
      • IMEKLMG.EXE (PID: 312)
      • wmpnscfg.exe (PID: 2388)
      • wmpnscfg.exe (PID: 2460)
      • wmpnscfg.exe (PID: 2576)
      • IMEKLMG.EXE (PID: 2052)
      • Holzer.exe (PID: 3396)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2660)
      • chrome.exe (PID: 1016)
      • WinRAR.exe (PID: 2560)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2120)
      • Setup.exe (PID: 2544)
      • ShedulerYori.exe (PID: 2856)
      • Setup.exe (PID: 3012)
      • ShedulerYori.exe (PID: 3092)
      • Setup.exe (PID: 3632)
      • Setup.exe (PID: 3828)
      • ShedulerYori.exe (PID: 4036)
      • Setup.exe (PID: 4060)
      • ShedulerYori.exe (PID: 3872)
      • Setup.exe (PID: 324)
      • ShedulerYori.exe (PID: 4028)
      • Setup.exe (PID: 1576)
      • ShedulerYori.exe (PID: 1972)
      • ShedulerYori.exe (PID: 1596)
      • IMEKLMG.EXE (PID: 312)
      • IMEKLMG.EXE (PID: 2052)
      • wmpnscfg.exe (PID: 2388)
      • wmpnscfg.exe (PID: 2460)
      • wmpnscfg.exe (PID: 2576)

    • Manual execution by a user

      • WinRAR.exe (PID: 1656)
      • WinRAR.exe (PID: 2660)
      • WinRAR.exe (PID: 1388)
      • Setup.exe (PID: 3012)
      • Setup.exe (PID: 2544)
      • Setup.exe (PID: 1000)
      • taskmgr.exe (PID: 3112)
      • cmd.exe (PID: 3328)
      • Setup.exe (PID: 3632)
      • Setup.exe (PID: 2228)
      • Setup.exe (PID: 3828)
      • Setup.exe (PID: 3536)
      • Setup.exe (PID: 4060)
      • Setup.exe (PID: 324)
      • Setup.exe (PID: 128)
      • Setup.exe (PID: 1772)
      • Setup.exe (PID: 1576)
      • runonce.exe (PID: 2036)
      • IMEKLMG.EXE (PID: 2052)
      • IMEKLMG.EXE (PID: 312)
      • wmpnscfg.exe (PID: 2388)
      • wmpnscfg.exe (PID: 2460)
      • wmpnscfg.exe (PID: 2576)
      • taskmgr.exe (PID: 4076)
      • Setup.exe (PID: 3780)
      • chrome.exe (PID: 2596)

    • Create files in a temporary directory

      • Setup.exe (PID: 2544)
      • WerFault.exe (PID: 1436)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1792)

    • Reads the time zone

      • runonce.exe (PID: 2036)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 312)
      • IMEKLMG.EXE (PID: 2052)

    • Application launched itself

      • chrome.exe (PID: 2596)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2560)
      • chrome.exe (PID: 2140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2021:09:11 22:15:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Setup/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
189
Monitored processes
70
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe no specs setup.exe no specs setup.exe sheduleryori.exe setup.exe sheduleryori.exe taskmgr.exe no specs cmd.exe setup.exe no specs setup.exe sheduleryori.exe setup.exe no specs setup.exe sheduleryori.exe setup.exe no specs setup.exe sheduleryori.exe setup.exe no specs setup.exe sheduleryori.exe setup.exe no specs setup.exe sheduleryori.exe taskmgr.exe ctfmon.exe no specs sipnotify.exe runonce.exe werfault.exe no specs werfault.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs taskmgr.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs holzer.exe no specs holzer.exe taskmgr.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
128"C:\Users\admin\Desktop\Click_here\Setup\Setup\Setup.exe" C:\Users\admin\Desktop\Click_here\Setup\Setup\Setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\click_here\setup\setup\setup.exe
c:\windows\system32\ntdll.dll
284"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4556 --field-trial-handle=1192,i,18043685965102614612,10326883054060425284,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
312"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
324"C:\Users\admin\Desktop\Click_here\Setup\Setup\Setup.exe" C:\Users\admin\Desktop\Click_here\Setup\Setup\Setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\click_here\setup\setup\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
348"C:\Windows\System32\WerFault.exe" -k -rqC:\Windows\System32\WerFault.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1000"C:\Users\admin\Desktop\Click_here\Setup\Setup\Setup.exe" C:\Users\admin\Desktop\Click_here\Setup\Setup\Setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\click_here\setup\setup\setup.exe
c:\windows\system32\ntdll.dll
1016"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=4328 --field-trial-handle=1192,i,18043685965102614612,10326883054060425284,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1388"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Click_here.zip" C:\Users\admin\Desktop\Click_here\C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1436C:\Windows\System32\WerFault.exe -k -qC:\Windows\System32\WerFault.exe—WerFault.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
16 504
Read events
16 263
Write events
238
Delete events
3

Modification events

(PID) Process:(116) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
4
Suspicious files
212
Text files
33
Unknown types
0

Dropped files

PID
Process
Filename
Type
2596chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF6225.TMP —
MD5:—
SHA256:—
2596chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1656WinRAR.exeC:\Users\admin\Desktop\Click_here\Setup\password-is-237385.txttext
MD5:DF8BAFF7A3AB716B3D6C8F382A586868
SHA256:CAC1789B0443E2FE0419BD302309CF28E55000EFEA404C5B51A9118650C1B80B
2036runonce.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etlbinary
MD5:6D1DA9DB986A5E19D4D764B0D6DC1C03
SHA256:7FFA849896048F6C1592E9B09A67791AAB87062FD1A17CA071264BCDC8683F81
2544Setup.exeC:\Users\admin\AppData\Local\Temp\ShedulerYori.exeexecutable
MD5:B724E4BC22D5F782A6F991D67FB00FB6
SHA256:627611F37A051DC649065489CF39E9666701B2C235AC3F8D43712DDD723DD710
1388WinRAR.exeC:\Users\admin\Desktop\Click_here\Setup\password-is-237385.txttext
MD5:DF8BAFF7A3AB716B3D6C8F382A586868
SHA256:CAC1789B0443E2FE0419BD302309CF28E55000EFEA404C5B51A9118650C1B80B
2660WinRAR.exeC:\Users\admin\Desktop\Click_here\Setup\Setup\Setup.exeexecutable
MD5:5A435DBB34225EE123506EEFE5EF141D
SHA256:9543FF1AEC6FFF81E2A2EC65841864ACFDD71343FB88DA5B8F0575D41AFCB87C
1792sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\main.jpgimage
MD5:B342ACE63F77961249A084C61EABC884
SHA256:E5067BBA2095B5DA7C3171EC116E9A92337E24E471339B0860A160076EFE49B9
2596chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF6215.TMPtext
MD5:05CF4C3C5148DA6355D3561A9EAA5E8A
SHA256:8D720243F6876898E4F197C8867C4CEE69F1C7335C55B8A29C120B1028D93E41
1436WerFault.exeC:\Users\admin\AppData\Local\Temp\WER-9562-0.sysdata.xmlxml
MD5:B7E38B5A83FC38998EEA25968B42554E
SHA256:5CB3B571D015C8DF84D1842C2D5E5F872829FBEF998EE36BC67C4A38342B95DF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
78
DNS requests
93
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2764
chrome.exe
GET
200
91.215.42.31:80
http://gg.gg/css/style.css
unknown
text
1.39 Kb
unknown
1792
sipnotify.exe
HEAD
200
23.197.138.118:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133474586367650000
unknown
—
—
unknown
2764
chrome.exe
GET
200
91.215.42.31:80
http://gg.gg/css/jquery.tagit.css
unknown
text
452 b
unknown
—
—
GET
200
91.215.42.31:80
http://gg.gg/js/jquery-1.7.2.min.js
unknown
html
33.0 Kb
unknown
2764
chrome.exe
GET
200
91.215.42.31:80
http://gg.gg/
unknown
html
1.78 Kb
unknown
—
—
GET
200
91.215.42.31:80
http://gg.gg/js/jquery.cookie.js
unknown
text
837 b
unknown
—
—
GET
200
91.215.42.31:80
http://gg.gg/css/smoothness/jquery-ui-1.8.21.custom.css
unknown
text
5.91 Kb
unknown
—
—
GET
200
91.215.42.31:80
http://gg.gg/js/jquery.corners.min.js
unknown
text
3.20 Kb
unknown
2764
chrome.exe
GET
200
91.215.42.31:80
http://gg.gg/js/jquery-ui-1.8.21.custom.min.js
unknown
text
50.8 Kb
unknown
—
—
GET
200
91.215.42.31:80
http://gg.gg/js/jquery.zclip.min.js
unknown
text
2.59 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2856
ShedulerYori.exe
212.193.30.45:80
—
Delis LLC
CZ
unknown
3092
ShedulerYori.exe
212.193.30.45:80
—
Delis LLC
CZ
unknown
2856
ShedulerYori.exe
212.193.30.29:80
—
Delis LLC
CZ
unknown
3092
ShedulerYori.exe
212.193.30.29:80
—
Delis LLC
CZ
unknown
4036
ShedulerYori.exe
212.193.30.45:80
—
Delis LLC
CZ
unknown
3872
ShedulerYori.exe
212.193.30.45:80
—
Delis LLC
CZ
unknown
4028
ShedulerYori.exe
212.193.30.45:80
—
Delis LLC
CZ
unknown

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared
query.prod.cms.rt.microsoft.com
  • 23.197.138.118
whitelisted
clientservices.googleapis.com
  • 216.58.212.131
whitelisted
accounts.google.com
  • 74.125.71.84
shared
www.google.com
  • 142.250.186.132
whitelisted
www.gstatic.com
  • 216.58.212.131
whitelisted
apis.google.com
  • 172.217.16.206
whitelisted
update.googleapis.com
  • 172.217.16.195
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.174
whitelisted
lh5.googleusercontent.com
  • 216.58.206.33
whitelisted

Threats

PID
Process
Class
Message
2764
chrome.exe
Misc activity
ET INFO GG Url Shortener Observed in DNS Query
2764
chrome.exe
Misc activity
ET INFO GG Url Shortener Observed in DNS Query
2764
chrome.exe
Misc activity
ET INFO GG Url Shortener Observed in DNS Query
2764
chrome.exe
Misc activity
ET INFO GG Url Shortener Observed in DNS Query
2764
chrome.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
2764
chrome.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
2764
chrome.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
2764
chrome.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
2764
chrome.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
2764
chrome.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Click_here.zip